We use cookies to customise content for your subscription and for analytics.If you continue to browse Lexology, we will assume that you are happy to receive all our cookies. For further information please read our Cookie Policy.

Consumer groups push FTC to investigate popular candy social media contest for alleged violations of COPPA

According to a Request for Investigation filed with the Federal Trade Commission (“FTC”) on December 9, 2014, a coalition of consumer and children’s privacy rights organizations has asked for a federal investigation of the Topps Company for allegedly violating the Children’s Online Privacy Protection Act (“COPPA”) by collecting personal information and photos from children without parental permission in a social media contest.

The groups challenge a Topps Co. candy brand contest held in April 2014 that solicited Facebook, Twitter and Instagram social media users to tag photos of themselves wearing Ring Pops with the hashtag #RockThatRock for a chance to be featured in a music video with the popular “tween” band R5. Winning photos were featured in the music video, and the video was posted on the website Candymania, YouTube, and on Bazooka Candy Brand social media pages. Topps Co. also featured submitted photos on its website, social media platforms and in television commercials.

COPPA prohibits companies from collecting personal information from a child unless it provides notice and obtains advance, verifiable parental consent. COPPA was revised and expanded in July 2013. The groups’ Request for Investigation focuses on Topps Co.’s alleged oversight of two significant revisions under COPPA. Under the revised version of COPPA, the definition of personal information includes a broader range of information, including geolocation information, as well as photos, videos and audio files that contain a child’s image or voice, or even a persistent identifier that could be used to recognize the child over time and across different websites or online services.

The revised COPPA also outlines new ways to obtain “verifiable” parental consent. Methods that meet COPPA’s requirement include (i) providing a consent form to be signed by a parent and returned by mail or fax; (ii) requiring parents to use a credit card in a transaction; (iii) having parents call a toll-free number staffed by trained personnel; (iv) having parents connect to trained personnel via video-conference; or (v) verifying parents’ identity by checking a form of government-issued identification, such as a Social Security number, against databases of such information.

The groups argue that Topps Co.’s privacy policy and contest terms of use failed to accurately disclose its data collection practices in violation of COPPA and failed to obtain verifiable parental consent. According to the groups, the contest’s terms of use assert that the use of its services constituted parental consent, and the Company made no further effort to obtain verifiable consent as required under COPPA. Since COPPA was revised in July 2013, the FTC has approved new verifiable parental consent methods, such as knowledge-based identification, and the Commission seeks public comment on other submitted methods. However, when companies do not utilize approved methods or the methods outlined in COPPA, they risk scrutiny as evidenced in the Request.

The groups also point out that the amended COPPA requires operators of a website or online service directed to children to retain personal information only as long as is reasonably necessary. The groups maintain that the Candymania website is directed at children. According to the groups, Topps has violated COPPA because, even though the contest has ended, the #RockThatPop music video featuring submitted photos of children remains on YouTube and Candymania, and Topps hosts an event on social media known as #RockThatPop Fridays where it reposts contest photographs.

Advocacy groups seeking agency action may formally petition the FTC or make an informal request. More recently, these informal Requests for Investigation have resulted in formal government investigations, complaints and settlement agreements. For example, the FTC’s investigation of Snapchat and 2014 settlement occurred after an advocacy group placed the Company and its practices on the FTC’s radar when it filed a Request for Investigation with the Commission in 2013.

Related topic hubs

Compare jurisdictions: Data Security & Cybercrime

"As a busy in-house practitioner, I rarely have the time to attend formal seminars and conferences. Consequently, I find the news releases put out by the various law firms invaluable in keeping me up to date on developments in the law and recent case law. The service that Lexology provides, through consolidating those various news releases and grouping them under the relevant categories, is a timesaver for me and allows me to do a quick daily scan of recent developments."